Why an IT Security Concept Is No Longer a "Nice-to-Have"
Last week I had a conversation with the owner of a tax consultancy in Magdeburg. 15 employees, three locations, client data on a NAS in the basement. "IT security concept?" he asked. "We have an antivirus scanner." That was two days before his office was hit by a ransomware attack.
The truth is: An IT security concept is not optional for SMEs in 2026 – it's business-critical. The question is not if, but when an attack comes. And those who are prepared will survive it.
What an IT Security Concept Actually Is
An IT security concept is not a 200-page document gathering dust in a drawer. It's a living framework that defines:
- What IT assets your company has (hardware, software, data, cloud services)
- What threats they face
- What protective measures are in place
- Who does what in an emergency
- How regularly everything is reviewed
Think of it as a business plan – but for your digital security. And just like a business plan, it should be regularly updated.
Step 1: Inventory – What Do You Actually Have?
Before you can protect anything, you need to know what you're protecting. This sounds trivial, but it's not. In practice, most SMEs don't even know exactly which devices are connected to their network.
Create a complete asset list:
- Servers (physical and virtual)
- Workstations and laptops
- Smartphones and tablets
- Network devices (routers, switches, access points)
- Cloud services and SaaS applications
- Printers and IoT devices
Practical Tip: Use network scanners like Nmap or commercial tools like Lansweeper to automatically detect all devices. You'll be surprised at what's active on your network.
Step 2: Risk Analysis – What Can Go Wrong?
Now it gets interesting. For each asset, evaluate two things:
- Probability of occurrence: How likely is a specific attack?
- Impact: What happens if it occurs?
A simple matrix helps:
| Risk | Probability | Impact | Priority |
|---|---|---|---|
| Phishing attack on employees | High | High | Critical |
| Server failure due to hardware | Medium | High | High |
| Data loss from employee error | High | Medium | High |
| DDoS attack | Low | Medium | Medium |
| Physical break-in to server room | Low | High | Medium |
| ------ | ------------ | -------- | ---------- |
|---|---|---|---|
| Server failure due to hardware | Medium | High | High |
| Data loss from employee error | High | Medium | High |
| DDoS attack | Low | Medium | Medium |
| Physical break-in to server room | Low | High | Medium |
| Phishing attack on employees | High | High | Critical |
|---|---|---|---|
| Data loss from employee error | High | Medium | High |
| DDoS attack | Low | Medium | Medium |
| Physical break-in to server room | Low | High | Medium |
| Server failure due to hardware | Medium | High | High |
|---|---|---|---|
| DDoS attack | Low | Medium | Medium |
| Physical break-in to server room | Low | High | Medium |
| Data loss from employee error | High | Medium | High |
|---|---|---|---|
| Physical break-in to server room | Low | High | Medium |
| DDoS attack | Low | Medium | Medium |
|---|
For SMEs, the top 3 risks are almost always:
- Phishing and social engineering
- Ransomware
- Data loss due to missing backups
Step 3: Define Protective Measures
This is where it gets hands-on. For each identified risk, you need at least one countermeasure. The most important building blocks for SMEs:
Technical Measures
- Firewall with current rulesets and intrusion detection
- Endpoint Protection on all devices (not just antivirus)
- Two-Factor Authentication (2FA) for all critical systems
- Encryption for data at rest and in transit
- Automated Patch Management for operating systems and software
- Network Segmentation to limit damage
- Email Security with SPF, DKIM, and DMARC
Organizational Measures
- Security Awareness Training for all employees (at least quarterly)
- Password Policy (better: Passkeys or Passwordless Authentication)
- Access Rights Concept based on the Least Privilege Principle
- Clean Desk Policy for sensitive areas
- Onboarding/Offboarding Processes for employee access
Backup and Recovery
- 3-2-1-1-0 Backup Rule: 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors
- Regular Restore Tests (at least monthly)
- Defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
Step 4: Create an Emergency Plan
An IT security concept without an emergency plan is like a car without an airbag. You need clear answers to:
- Who gets notified? (Management, IT provider, data protection officer, authorities if needed)
- What happens immediately? (Isolate systems, secure evidence, communications)
- Who has which role? (Incident Commander, Communications, Technical)
- How is communication handled? (Not through potentially compromised systems!)
Important: Under GDPR Art. 33, you must report data breaches to the supervisory authority within 72 hours. Plan for this!
Step 5: Documentation and Policies
Put everything in writing. Not for the drawer, but as a living document:
- IT Security Policy (umbrella policy, maximum 10 pages)
- Network Plan with all components
- Authorization Matrix (Who has access to what?)
- Emergency Contacts (always keep current!)
- Change Log for all modifications
Step 6: Regular Review
An IT security concept is never finished. Plan for at least:
- Monthly: Check patch status, perform backup tests
- Quarterly: Review access rights, awareness training
- Semi-annually: Update risk analysis, practice emergency plan
- Annually: Complete audit, commission penetration test
What It Costs – Realistically
The good news: A basic IT security concept for an SME with 10-50 employees doesn't have to cost a fortune.
| Measure | Cost (approx.) |
|---|---|
| Inventory and risk analysis | €2,000-5,000 |
| Firewall (hardware + configuration) | €1,500-4,000 |
| Endpoint protection (per device/year) | €30-80 |
| Security awareness training (per year) | €1,000-3,000 |
| Backup solution (cloud-based) | €100-500/month |
| Penetration test | €3,000-8,000 |
| --------- | --------------- |
|---|---|
| Firewall (hardware + configuration) | €1,500-4,000 |
| Endpoint protection (per device/year) | €30-80 |
| Security awareness training (per year) | €1,000-3,000 |
| Backup solution (cloud-based) | €100-500/month |
| Penetration test | €3,000-8,000 |
| Inventory and risk analysis | €2,000-5,000 |
|---|---|
| Endpoint protection (per device/year) | €30-80 |
| Security awareness training (per year) | €1,000-3,000 |
| Backup solution (cloud-based) | €100-500/month |
| Penetration test | €3,000-8,000 |
| Firewall (hardware + configuration) | €1,500-4,000 |
|---|---|
| Security awareness training (per year) | €1,000-3,000 |
| Backup solution (cloud-based) | €100-500/month |
| Penetration test | €3,000-8,000 |
| Endpoint protection (per device/year) | €30-80 |
|---|---|
| Backup solution (cloud-based) | €100-500/month |
| Penetration test | €3,000-8,000 |
| Security awareness training (per year) | €1,000-3,000 |
|---|---|
| Penetration test | €3,000-8,000 |
| Backup solution (cloud-based) | €100-500/month |
|---|
For comparison: The average damage from a successful ransomware attack on a German SME is €150,000-250,000. Not including reputational damage.
Templates and Frameworks
You don't have to reinvent the wheel. These frameworks help:
- BSI Basic Protection (specifically for German companies, free)
- ISO 27001 (international standard, for certification)
- VdS 10000 (specifically for SMEs, pragmatic approach)
- CISIS12 (12-step model, ideal for beginners)
For SMEs, I recommend starting with VdS 10000 or CISIS12 – both are practical and don't overwhelm.
Conclusion: Just Start
The perfect IT security concept doesn't exist. But a good, implemented concept beats a perfect one that's never written. Start with the inventory, identify the three biggest risks, and implement the countermeasures. Then expand step by step.
If you need support: We guide SMEs in the Saxony-Anhalt region from the first inventory to the finished security concept. Get in touch – the initial consultation is always free.
